Posted
by
Soulskill
on Thursday May 27, 2010 @01:49PM
from the who-wants-to-buy-a-level-80-paladin dept.

A Symantec blog post reports that the company recently stumbled upon a server hosting the stolen credentials for 44 million game accounts. It goes on to explain how the owners of the server made use of a botnet to process that mountain of data:
"Now it's time to turn those gaming credentials into hard cash. But how do you find out which credentials are valid and thus worth some money? Three options come to mind: 1) Log on to gaming websites 44 million times! 2) Write a program to log in to the websites and check for you (this would take months). 3) Write a program that checks the login details and then distribute the program to multiple computers. Option one naturally seems next to impossible. Option two is also not very feasible, since websites typically block IP addresses after multiple failed login attempts. By taking advantage of the distributed processing that the third option offers, you can complete the task more quickly and help mitigate the multiple-login failure problems by spreading the task over more IP addresses. This is what Trojan.Loginck's creators have done."

I an a little naive to the criminal enterprise that is stolen gaming credentials, but I have to wonder: why does it matter, if you are selling a stolen credential, if it's good or not? Is the buyer really going to come back and demand a refund when it doesn't work? And what real benefit are these, anyway? Don't tell me that people buy stolen creds and log into them just to take all their e-loot (worth thousands of e-dollars)? Oh for the love of humanity the things people will do in the name of wasting time.

Don't tell me that people buy stolen creds and log into them just to take all their e-loot (worth thousands of e-dollars)? Oh for the love of humanity the things people will do in the name of wasting time.

No, this is often the people who STOLE the creds, log in, and sell the E-loot for REAL money. If you've never played WoW, Eve, or Runescape for more than a Month, I wouldn't expect you to understand. But this is a problem that does occur regularly.

1: Someone visits a website which is either legit but gets served up a fake ad via an ad-rotater, or the site is using exploits directly. Either way, a keylogger gets downloaded. It can be an add-on that just logs keys in the background and ends when the Web browser is closed and not even installed on the system.

Seriously. Here's a system that, if put into widespread use, would not only make their game more appealing to players, but should also decrease their support costs by significantly reducing an issue that is a completely pain in the ass for all parties involved.

How many people does Blizzard employ just to spend all day taking care of hacked account related issues? They should be doing everything they can to make that problem go away.

Or you have to be smart enough not to visit shady websites that result in keyloggers getting installed on your system.

Or you have to be smart enough not to buy games from shady companies that designed a game with a built-in protection racket. It's not like they can't restore your character to an earlier point. And if they can't, their game blows.

You'd find something else to do, just like anyone with a normal psyche. This stuff does hold the potential for addiction, which for most of these people is the only explanation for their obsessive behavior.

Think about it: nobody really wants his life to be sitting in a chair wasting time and just waiting for death to come a little closer. Nonetheless, this is the behavior of folks with addictions.

Actually, that description sounds like having a (white collar) job. I produce nothing of value, but here I am, h

I cant say for other games, but for World of Warcraft, they sell the in game items for in game currency, and then turn around and sell the in game currency for actual real currency. There are several websites set up that sell "X gold for $y".

Is the buyer really going to come back and demand a refund when it doesn't work?

Probably not, but reputation must be worth something in criminal enterprises. Giving out a bunch of bogus products kills the word-of-mouth.

And what real benefit are these, anyway?
Well, all the criminal has to do is sell off the account for less than the game costs up-front. They make pure profit and people willing to buy stolen games get a discount. Steam accounts could probably be quite lucrative, for instance.

Probably not, but reputation must be worth something in criminal enterprises. Giving out a bunch of bogus products kills the word-of-mouth.

I can't imagine how they could sell those individually to gamers. For them it makes more sense to single out invalid accounts and to sell large blocks to less skilled criminals at a premium. Just like in the normal business world one would pay more than twice for a product which has a 0% failure rate instead of 50%. Of course one could just pretend that all accounts a

Is the buyer really going to come back and demand a refund when it doesn't work?

While I'd guess it's not impossible to just fake the account details, and maybe people do that, it could just be that these particular people found it is just more profitable to be legitimate after stealing the account for a variety of reasons. These are legitimate auction sites according to TFA.

Just guessing, but you see a account you'd like to get on the auction site, check to see if that character is actually good or has good equipment on WOW or whatever. If it isn't, no bid. If you buy it and the log

When the hired thugs come by your dark alley where you conduct your stolen credential business and complain about the quality of your premium stolen information, would you prefer they break your arms or your legs?

Is the buyer really going to come back and demand a refund when it doesn't work?

No, but it would be impossible to sell him a bigger list if the test account comes up empty. No one who would give any real good price for a large 'batch' of accounts would start out by 'testing' a 'supplier'. It shouldn't be surprising that, even to criminals, guaranteed results have a monetary value.
e.g. If you stole an apartment super's keyring, you could break into each home yourself. However few pickpockets like yourself have the stones for burglary, so instead you sell them to someone who will.

You know Slashdot doesn't let you say your own password? Check it out:

*********

Also, Alt+F4 gets you instant Karma!

---

Had to get that out of me. So I didn't RTFA, but what I gather is that they used some kind of keylogger and now the server has 44 Million user credentials. At first I was like "Why didn't it just test the credentials when it recieved them, and then changed the password?" But that runs the risk of users detecting the virus, having it's spread shut down by Symantec, and the account being deeme

One of my co-workers was giving a presentation once (he is a self proclaimed computer expert in every facet), and he asked us "how do I make this power point presentation full screen?". We replied Alt-F4. He did it and said "hmm that is weird", and restarted power point and pressed Alt-F4 again... after attempting it 5 times he gave up and said "Oh well I guess we will just do the presentation like this".

I get your point, except that you should change your gaming password now anyway. It might have been you, it might not have, and your creds. might've been stolen by someone else entirely.

Change your passwords anyway.

This is true every moment of every day. Maybe my password was stolen a second ago, or maybe in the next second. We have to make some assumptions or else the protection becomes unusable.

Symantec, however, has the list and so makes far fewer assumptions as to whom should take action.

Also, having the list would let people know that they are in need of better security, along with letting them know their password needs changed. Omitting the former means your new password would be immediately compromised as we

I used to have a lot of fun with that, when I was the sysadmin for a large site. It seemed every script kiddie wanted the password to it. It showed up regularly on passwordz sites. We had a whole bunch of triggers to detect and resecure accounts. One of the easy and obvious ones was to let them post it, and catch it afterwards (usually within seconds of being posted). The legitimate account holder got a notification that we changed their password to a secure one. Everyone else just sat there and wondered how we'd catch them so fast.

That trigger was pretty low on the list though. My favorite was to catch 'em scanning for passwords. If they tried say 1000 wrong passwords in a short period, but got one or two right, we'd let them keep scannning for a while, and then block their access to the server. (iptables drop rule). Then the program would figure out which passwords they actually got right, change those, and notify the account holder of their new password.:) It was always fun to see what the delay was between them finding a password, and when it started being used from passwordz sites. In those cases, we always had the account secured before they had time to post it. The typical time from being scanned to being posted was about 12 hours. The typical time for us to reissue the passwords was less than 5 minutes.

I can't imagine online game places wouldn't have something similar. Brute force attacks are just too easy, and people will always try them. How many different usernames can a person really try before you know that they're just brute force attacking.

Hopefully they'll try to return all these stolen credentials back to the owners. Returning stolen property can get pretty costly though, with so many different owners. They can't just go destroying them, then the owners would lose them.

What would be the point of publishing a 500 MB (@~11 chars/user) text file? And how would they do that? If anyone gives a shit about their account, they'll just change their password as soon as they hear about this.

Also, let's do some statistics, shall we? Let's say there are 20 million WoW accounts (pulled the number out of my ass, Wikipedia said 12 million in 2008). There are also 0.2 million stolen WoW accounts. The chance of your account being compromised is 100:1. Pretty high, if you ask me, so just sc

What, was it placed on their doorstep one night, and they didn't notice it when they went outside to get the morning paper?

So, they wrote a crawler that intrusively scanned servers that they didn't have permission to access, opening and analyzing files that they didn't have permission to read, then published what they found?

And the penalty if I did that is, what, 5 years in federal PMITA prison?

And the penalty if I did that is, what, 5 years in federal PMITA prison?

There is something wrong in this world.

You're quite wrong. This is an example of one of the few somethings that is right in this world. Selective enforcement is designed into the system, along with jury nullification, to help the laws achieve ends that keep the public they support happy. Any "completely fair" application of the law would make it unworkable in very short order.

Could you imagine a robot issuing you indecency citations every time you pass gas in public? Could you imagine a police officer doing the same if you passed gas into a megaphone-amplified-sound-system aimed at, say, an Inaugural speech? Context is key, and thankfully so.

Neither of the cases you cite are actually illegal. This is a key feature of the law, if something isn't codified as illegal, it's NOT ILLEGAL. The context is effectively null, since the example isn't valid.

You say that any completely fair application of the law would make it unworkable. That is the biggest pile of bullshit I've seen on/. in a long long time. Believe me, that's saying something. ONLY a completely fair application of the law works. Our founding fathers knew this. Our ancestors knew this. The fact that you don't know this is frightening beyond reason. You didn't say, but you implied that symantec should have rights and privileges that an ordinary citizen does not. That is the largest perversion of the law that is possible. Companies do not have any trust, they can't be given confidence, because they exist for ONLY one purpose, to make money. You can trust a person, you can't trust a company, and even attempting to do so is foolish (at least) and IMNSHO stupid beyond belief. Our entire foundation of laws is based on the INDIVIDUAL being the top, and everything else coming second. If you know believe that corporations should be on top (they are, but they should not be), well, we've already lost, haven't we?

Don't let me squash your corporate angst that you're grooving on, but you're entirely off my point, and have gone on to bend it towards one of your own.

Symantec being 'the machine' is completely irrelevant. We still use them as a tool to keep our computers protected (the effectiveness is debatable, but not the use), and so would definitely allow them more leeway than we would an individual that neither harms nor benefits us.

Our founding fathers knew this.

Our founding fathers were, by the strictest application of the law, brazen criminal

Our founders knew that equality under the law mattered. They sure as hell didn't get it right in their lives, but they went further than anyone else had.

YES, I expect every law to be enforced for every infraction, or I expect the law to be changed. If selective enforcement is the rule, then prejudice, classism, and eventually a chaste system will prevail. You can live in that world, or we can all

Jeez, but you're frothy. How do you possibly know me well enough to label me in such ways? (Hint, slashdot has a posting history feature...) And why didn't you respond to the non-prosecution of our founding father's crimes?

I'm not telling you that I necessarily support every possible imaginary application of selective enforcement, but only that it is implicit and necessary in the system for us to have a thing we like to call 'justice'. If you don't get it, fine. If you disagree, try and do so on more th

I don't recall labeling you, just rejecting the labels you put on me. Also, I would have prosecuted the founders of this country, if they had violated the laws of this country (which they almost certainly did)

Let me try again with a little less froth. I believe in justice, and I don't believe that can be achieved by selective enforcement. Only by just laws. I do realize that under our current system I pretty much have to accept a little bit of both. At least for now. However, that doesn't mean I'm o

[citation needed] Can you cite a single government document that says this? "Selective enforcement" does in fact exist, but it is almost always used unfairly. It's an excuse to target the poor or minorities and let the rich and powerful off the hook.

Sometimes they have "zero tolerance" policies in place in my city, and they're always in place in the ghetto. This coountry was NOT started with the concept of "selective enforcement" in mind, it was started with

"Selective enforcement" does in fact exist, but it is almost always used unfairly.

Selective enforcement, by definition, is ALWAYS used unfairly. Sort of like how water is wet.

Not necessarily. I say this having had a law selectively enforced against me. In my state, it is illegal to gamble, except in the state lottery or at Indian casinos. This is selectively enforced, and everybody knows it. It's even in the case law. The purpose of the law is not to stop gambling from occurring, but to stop it from becoming a racket or other public nuisance. It would be nearly possible to write all the distinctions into law for the types of gambling our state considers okay and the types

Perhaps I got my arguments crossed, but I've been tangoing with many on here that want to see every infraction dealt with on exactly the same terms, and are labeling this as 'fair'. You're saying it can be (something close to) fair to society while not necessarily being entirely fair to the individual, or something, which is fine.

But as long as it is selective, there will be errors and 'fair', being equitable, in the sense it was being used earlier cannot exist.

It was probably one (some) of their client's servers that got hacked and used in the collection of the credentials. The client found out that they got hacked and demanded that Symantec explain what happen. Symantec investigated and found out.

They're not going to say "a server we were protecting with our products got hacked and was used in an operation to steal 44 million credentials..."

What, was it placed on their doorstep one night, and they didn't notice it when they went outside to get the morning paper?

So, they wrote a crawler that intrusively scanned servers that they didn't have permission to access, opening and analyzing files that they didn't have permission to read, then published what they found?

Symantec and many other companies set up honeypot computers.The honeypot gets infected, Symantec pulls apart the trojan and studies its web traffic.This usually leads to the dumpsite where the trojan is uploading the data.

Many botnet/trojan masters don't bother to encrypt their data dumps or secure the server hosting it.And even if they did, are they going to sue Symantec for unauthorized access?

Sounds more like FUD to get people to buy into Symantec so something like this never happens to your computer. Legitimately though they could have looked at the viruses they were finding and traced them back to the server that was commanding the botnet. I would say the numbers are estimates and no actual cracking occurred as there was no specifics on how they found the data, which would be much more interesting. Everyone has heard tonnes about DDOS already and this is just another boiler plate application o

> OK, so Symantec "recently stumbled upon a server hosting...".> What, was it placed on their doorstep one night, and they didn't notice it when they went outside to get the morning paper?> So, they wrote a crawler that intrusively scanned servers that they didn't have permission to access, opening and analyzing files that they didn't have permission to read, then published what they found?

Yeah, it's not like Symantec reverse engineered a trojan that was attracting their attention (Trojan.Loginck),

RTFA. This is not a case of Symantec hammering through random servers looking for bogeymen.

The very first sentence of the article states that the server was flagged from a new set of sample data submitted to Symantec. This is likely user data aggregated from Norton's threat detection network.

That somehow gives them the right to go rummage through that server uninvited, reading and analyzing what they found and publishing it? Now, I know the vigilante in all of us wants to say "yes", but it's not clear to me that the law permits that kind of activity. And I stand by my statement that, if I did it, I'd end up a very unhappy puppy.

Let's imagine that I find some Symantec product on my machine that I didn't install, and I find a server address

Let's imagine that I find some Symantec product on my machine that I didn't install, and I find a server address in the code. Does that give me the right to go pillage Symantec's machine and publish information about what I'd found?

There are several underlying issues which are highly relevant to your argument:1. Was the unwanted code contacting that particular server from your computer?2. Can a bad actor grant access rights to his program but not to you, the user whose machine it is residing on?3. If the bad actor does not secure the information on an internet facing server, have you exceed access by "pillaging" it?4. Can a bad actor even make a claim of unauthorized access?

That somehow gives them the right to go rummage through that server uninvited, reading and analyzing what they found and publishing it? Now, I know the vigilante in all of us wants to say "yes", but it's not clear to me that the law permits that kind of activity.

I thought having a Just Plain Wrong moderation option would be useful, but it would just be abused by trolls. So instead one must actually respond to wrong such as you and others have. It helps foster the community in that we can't just say something is wrong, but we have to say how it is wrong.

Summary (and article) claims "44 million stolen gaming credentials", which sounds like a lot of us English-speaking and English-game-playing Slashdot readers.

However, in the article, they analyze "a particular sample", with about ~18.3 million accounts in it. Of those ~18.3 million, ~16 million of them were game accounts for "Wayi Entertainment", which is an Asian company. They have no English website, that I can tell, and I think it's a safe assumption there are no English counterpart to these games.

The article glosses over the fact that *millions* of accounts are discovered.

That suggests the data is captured in massive quantities at one time. Specifically, 210,000 WoW accounts are hard to come by one-by-one. The computing effort might not be great, but the time to trawl compromised PC's would seem to be. Am I completely off-base with this assumption?

My point being, the bigger problem seems to be blocks of data that must come from the inside of these organizations pretends not to exist. Instead we

They would split up the list and sell it as small lists. E.g. you could split it up into lists of 1000 accounts or less, wheras the newest accounts are the most likely to work, thus having the highest price or similar.

Your post is the closest in the discussion to how to make money out of the list. The only problem is that you didn't think big enough. So the problem is that you can only sell each list once, and the stinky ones are hard to shift.

Rather than sell the lists you want to securitise them. Bundle the lists up into tranches and sell rights to the loot in each tranche. By using clever financial magic we can make the bad stink from the oldest accounts go away and sell each account many times over.

There are lots of holes in games since the last thing that programmers or gamers really want to think about is account security. (Cheating security frequently is the first thing that comes to mind.)

One of my buds ran a long thread here [incgamers.com] a while back. Several of his accounts were taken...don't remember how they got his WoW account. But it ended up that he eventually figured out that a server admin had poisoned a Web-downloadable.exe map pack file with a trojan that scraped some account info off files while

But it ended up that he eventually figured out that a server admin had poisoned a Web-downloadable.exe map pack file with a trojan that scraped some account info off files while running a keylogger to get anything that the scraper missed. These hackers are usually on top of their game

That's one step above coldcalling your friend and asking for his credentials. These aren't "hackers" "on top of their game"...your bud is just a complete moron.

Although a little outdated, mmogchart [mmogchart.com] had the total number of active MMO subscriptions at less than 20 million in 2008. Makes you wonder 1) what % of those 44 million are inactive accounts, and 2) what do they do when they find an inactive account - scrap it, save it, or purchase an untraceable game-time card to reactivate?

If their methods for stealing logins are that advanced, do you think they have some sort of organization of those inactive accounts by likelihood of them containing enough loot to be wo

It was also hacked, months after I canceled my subscription. No idea how.

So, in short, they sit on the account info and wait until it is inactive. This way they are less likely to be noticed as they link the WoW account to a battle.net account that they control. They also PAY to have the stolen account reactivated and thus raise no flags with Blizzard. It looks like someone simply reactivated the account as far as Blizzard is concerned.

I wonder about this, this costs a lot of money for someone to activate your account for you....and use it to farm maybe 20$ a month (= to 10,000 gold?) worth of gold, if they are good....and even then would not blizzard realize something is up if the ip address is now playing from china instead of the us???I was also thinking if you had your account hacked when it was deactivated, trying to log unto it once in a while during the time it is deactivated should be good, as well changing the password to your ac

Keep in mind that that account was probably being used by several people, 24/7. 10k gold is nothing to these guys. They can whip it up pretty quick, especially since they are using Bots. At that point, it is just a computer generating money. As long as the numbers balance to the black, all is good and it was worthwhile.

The IP is more then likely going through a controlled proxy, giving the appearance that the account is being accessed from the US.